CVE-2025-11844 json
XPath Injection in Hugging Face Smolagents search_item_ctrl_f Function
published 2025-10-22 12 mo ago modified 2026-10-08 32 d ago also GHSA-8mf9-rmgw-33qc , PYSEC-2026-1930 , EUVD-2025-35361
- cvss
- 5.4
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 20%
- public exploits
- 0
- none known
Summary
Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py. The function constructs an XPath query by directly concatenating user-supplied input into the XPath expression without proper sanitization or escaping. This allows an attacker to inject malicious XPath syntax that can alter the intended query logic. The vulnerability enables attackers to bypass search filters, access unintended DOM elements, and disrupt web automation workflows. This can lead to information disclosure, manipulation of AI agent interactions, and compromise the reliability of automated web tasks. The issue is fixed in version 1.22.0.
Patch / fix
- pypi smolagents 1.22.0
- huggingface huggingface/smolagents 1.22.0
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 12 mo ago
Exploit prediction
0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- huntr.com https://huntr.com/bounties/01ab4405-9bca-4b26-b7a3-5ca1863a69b4 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 5.4 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
| GitHub | 3.0 | 5.4 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
| OSV | 3.0 | 5.4 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | smolagents | <1.22.0 |
1.22.0 |
Affected products
- huggingface huggingface/smolagents
Classification
- Weakness
-
- CWE-643 Improper Neutralization of Data within XPath Expressions
References
-
github.com
/huggingface/smolagents/commit/f570ed5e17999d4cf7d5e79c2830fbaefab8a794
web, patch
-
huntr.com
/bounties/01ab4405-9bca-4b26-b7a3-5ca1863a69b4
exploit, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-11844
advisory
-
github.com
/huggingface/smolagents
package
-
pypi.org
/project/smolagents
package
-
github.com
/advisories/GHSA-8mf9-rmgw-33qc
advisory
Sources
- CVE List CVE-2025-11844
- GitHub Advisory GHSA-8mf9-rmgw-33qc
- NVD CVE-2025-11844
- OSV PYSEC-2026-1930
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.